CMS providers Joomla and WordPress have patched an arbitrary file download vulnerability in the HD FLV Player plug-in, but custom websites running the plug-in independently remain at risk.
Monthly Archives: December 2014
RedCloth contains unfixed XSS vulnerability for 9 years
Posted by Kousuke Ebihara on Dec 11
I disclosed the following advisory about a XSS vulnerability of
RedCloth (Textile library for Ruby).
http://co3k.org/blog/redcloth-unfixed-xss-en
You shouldn’t use RedCloth to parse user inputted contents and output
the parsed string (except that you allow your
user to write arbitrary JavaScript code on your site) because it
contains unfixed XSS vulnerability for 9 years,
and it be also disclosed for 2 years.
Unfortunately, we may not…
BMC TrackIt! Unauthenticated Arbitrary Local System User Password Change
Posted by Brandon Perry on Dec 11
BMC TrackIt! 11.3 Unauthenticated Local User Password Change
Trial available here: http://www.trackit.com
A Metasploit pull request has been made here:
https://github.com/rapid7/metasploit-framework/pull/4359
BMC TrackIt! 11.3 when installed with TrackItWeb! allows an unauthenticated
user to change any local user’s password, such as Administrator. If the
ability to log in remotely via SMB is enabled on the server, this can yield
an…
Researcher: ‘Lax’ Crossdomain Policy Puts Yahoo Mail At Risk
A security researcher disclosed a problem with a loose cross-domain policy for Flash requests on Yahoo Mail that puts email content and contacts at risk.
CVE-2014-3058
Cross-site request forgery (CSRF) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVE-2014-6143
The IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows local users to obtain sensitive information by reading a response.
CVE-2014-6163
Cross-site scripting (XSS) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
AVG talks about Privacy at CES Lifelong Tech Summit
AMSTERDAM and SAN FRANCISCO – December 11, 2014 – AVG Technologies N.V. (NYSE: AVG), the online security company™ for 188 million active users, today announced it will speak at the Lifelong Tech and exhibit at the Family Tech Summits at the 2015 International Consumer Electronics Show (CES) being held January 6-9, 2015 in Las Vegas.
Highlighting the company’s participation is AVG Chief Marketing Officer Judith Bitterli’s Tech Talk on Jan. 6 on “The Privacy Fear Factor,” a guide to essentials for online safety.
“Feeling safe, comfortable and confident online, especially in our increasingly connected and mobile world, can seem overwhelming if you don’t have the right tools in place,” said Bitterli, who regularly blogs on tech topics for Boomers at AVG Now. “The 50+ audience wants to be connected, engaged, informed and entertained. But privacy has been a major issue for them in fully utilizing the Internet – which has become an essential part of all of our lives. We must address the these issues so we can safely access the services we need — from health records to financial and social sites.”
As part of the presentation, Bitterli will share insights around Boomers’ tech usage and attitudes about privacy and protection issues, including findings from AVG’s new Digital Diaries Boomer research study.
The Lifelong Tech Summit (formerly the Silver Summit) looks at products and services that impact the lives of Boomers – which accounts for approximately 78 million US citizens (450 million worldwide) born between 1946 and 1964. This year’s Summit is designed to showcase the latest products and solutions for lifelong learning, enhancing and augmenting sensory experience, smart home control, healthy aging, and more. See more at: http://livingindigitaltimes.com/
What: ‘The Privacy Fear Factor’ presentation at Lifelong Tech Summit at CES
Who: AVG Technologies’ CMO Judith Bitterli
When: 1:30 p.m. January 6, 2015
Location: The Venetian, Level 2, Bellini 2006
AVG also will exhibit at the Family Tech Summit’s Cool Mom’s Showcase, being held Jan. 6-9 at CES Tech West, Sands Expo Level 2, Cool Products Pavilion #74935. This event is designed to highlight products that help families save time and energy so they can devote it to what’s important. AVG will showcase some of its key online security and privacy products for families, including “Magda and Mo”, the series of interactive online books that help children learn how to stay safe online. Location Labs by AVG, which was acquired by AVG in September 2014, will feature its Phone Controls service, which US customers can try for free through their tier 1 wireless carrier. Phone Controls lets parents see at a glance and limit how kids use phones, through real-time alerts and easy-to-read weekly email summaries on texting, calling and app downloads.
###
About AVG Technologies (NYSE: AVG)
AVG is the online security company providing leading software and services to secure devices, data and people. AVG has over 188 million active users, as of September 30, 2014, using AVG’s products and services including Internet security, performance optimization, and personal privacy and identity protection. By choosing AVG’s products, users become part of a trusted global community that engages directly with AVG to provide feedback and offer mutual support to other customers.
All trademarks are the property of their respective owners.
Contacts:
US
Jordan Byrnes
Waggener Edstrom
[email protected]
+1 (415) 547 7049
UK
Samantha Woodman
Waggener Edstrom for AVG
[email protected]
+ 44 (0)20 7632 3840
Gentoo Linux Security Advisory 201412-07
Gentoo Linux Security Advisory 201412-7 – Multiple vulnerabilities have been found in Adobe Flash Player, the worst of which allows remote attackers to execute arbitrary code. Versions less than 11.2.202.425 are affected.
Debian Security Advisory 3096-1
Debian Linux Security Advisory 3096-1 – Florian Maury from ANSSI discovered a flaw in pdns-recursor, a maliciously-constructed zones or a rogue server could affect the performance of pdns-recursor, thus leading to resource exhaustion and a potential denial-of-service.